CVE-2008-1866

admin/modifconfig.php in Blog Pixel Motion aka PixelMotion does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct...

CVE-2008-1867

CVE-2008-1867 describes a SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion). The issue allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, potentially related to include/requetesIndex.php. The vulnerability affects the affected...

CVE-2008-1868

CVE-2008-1868 affects Blog Pixel Motion (Blog Pixel Motion) via admin/sauvBase.php, where authentication is not required. The underlying issue allows remote attackers to trigger a database backup dump and retrieve the resulting blogPM.sql, which contains sensitive information. The vulnerability e...

CVE-2008-1868

admin/sauvBase.php in Blog Pixel Motion aka Blog PixelMotion does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information...

CVE-2008-1867: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Blog Pixel Motion aka Blog PixelMotion allows remote attackers to execute arbitrary SQL commands via the categorie parameter to index.php, possibly related to include/requetesIndex.php...

CVE-2008-1866: Improper Control of Generation of Code

admin/modifconfig.php in Blog Pixel Motion aka PixelMotion does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct...

CVE-2008-1868: Improper Authentication

admin/sauvBase.php in Blog Pixel Motion aka Blog PixelMotion does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information...

CVE-2005-4848: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the decompression algorithm in Research in Motion BlackBerry Enterprise Server 4.0 SP1 and earlier before 20050607 might allow remote attackers to execute arbitrary code via certain data packets...

CVE-2007-3483

Research in Motion BlackBerry Enterprise Server 4.0 through 4.1 has a default configuration that permits installation of arbitrary third-party applications on BlackBerry devices, which might facilitate loading of malware...

CVE-2007-3483

CVE-2007-3483 affects Research in Motion BlackBerry Enterprise Server 4.0–4.1. The vulnerability arises from a default configuration that allows installation of arbitrary third-party applications on BlackBerry devices, potentially enabling loading of malware. The available documents explicitly de...

CVE-2007-3483: Undefined Security Weakness

Research in Motion BlackBerry Enterprise Server 4.0 through 4.1 has a default configuration that permits installation of arbitrary third-party applications on BlackBerry devices, which might facilitate loading of malware...

Format string

Format string vulnerability on the Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 allows remote attackers to cause a denial of service blocked call reception and calling via format string specifiers in an SIP INVITE message that lacks a host name in the Contact header...

Design/Logic Flaw

The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service temporary device hang by sending a certain SIP INVITE message, but not providing an ACK when the call is answered...

Format string

The Research in Motion BlackBerry 7270 with 4.0 SP1 Bundle 83 allows remote attackers to cause a denial of service blocked call reception via a malformed SIP invite message, possibly related to multiple format string specifiers in the From field, a spoofed source IP address, and limitations of th...

CVE-2007-3442

Format string vulnerability on the Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 allows remote attackers to cause a denial of service blocked call reception and calling via format string specifiers in an SIP INVITE message that lacks a host name in the Contact header...

CVE-2007-3443

The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service temporary device hang by sending a certain SIP INVITE message, but not providing an ACK when the call is answered...

CVE-2007-3443

The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service temporary device hang by sending a certain SIP INVITE message, but not providing an ACK when the call is answered...

CVE-2007-3443

CVE-2007-3443 affects Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108. The vulnerability stems from improper management of transaction states in the SIP handling, enabling a remote attacker to cause a denial of service (temporary device hang) by sending a particular SIP INVITE messag...

CVE-2007-3444

The CVE-2007-3444 entry concerns the Research in Motion BlackBerry 7270 with 4.0 SP1 Bundle 83. Affected component: the SIP processing path that handles INVITE messages. Root cause described as potential multiple format string specifiers in the From field, combined with a spoofed source IP and fu...

CVE-2007-3443: Undefined Security Weakness

The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers to cause a denial of service temporary device hang by sending a certain SIP INVITE message, but not providing an ACK when the call is answered...